CCFR CCFR-201b Passing Score

CrowdStrike Certified Falcon Responder Questions and Answers

Question 33

A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?

Options:

An interactive user login via RDP.

A Windows Service or a process launched by the Service Control Manager.

A web browser download initiated by the end user.

A script executed directly from a removable USB drive.

Question 34

Which of the following is returned from the IP Search tool?

Options:

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IP

IP Detection Summary information for detection events containing the given IP

Question 35

Which of the following sentences best describes the primary use of the ' Hash Executions ' Search (Bulk Search)?

Options:

It allows a responder to upload a file to the cloud for detonating in a sandbox.

It allows for a summary view of the environment-wide presence of a given list of multiple hashes.

It allows an administrator to block a single hash across all machines.

It provides a detailed process tree for every execution of a single hash.

Question 36

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Options:

User logons after the detection

Executions of schtasks.exe after the detection

Scheduled tasks registered prior to the detection

Pivot to a Hash search for taskeng.exe

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce